Trust Center
Security, compliance, and data protection are foundational to Fleece AI. We build trust through transparency, rigorous controls, and continuous improvement.
Compliance & Certifications
EU AI Act
CompliantEU Artificial Intelligence Act (Regulation 2024/1689). Classified as non-high-risk AI system. Transparency obligations met: AI interaction disclosure, synthetic content labeling, and AI literacy measures implemented.
SOC 2 Type II
In ProgressService Organization Control 2 — Trust Service Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.
ISO 27001:2022
PlannedInternational standard for Information Security Management Systems (ISMS). Covers risk assessment, access control, cryptography, and business continuity.
GDPR
CompliantEuropean General Data Protection Regulation. Data subject rights (export and deletion), a Data Processing Agreement, and Standard Contractual Clauses for transfers outside the EEA.
CCPA
CompliantCalifornia Consumer Privacy Act. Supports right to know, right to delete, and right to opt-out of data sales.
Security Controls
AI Transparency (EU AI Act)5 controls
- AI badge on all assistant messages (Art. 50.1)
- AI-generated disclaimer in chat interfaces (Art. 50.1)
- AI-generated content labeled in emails (Art. 50.2)
- Non-high-risk assessment documented (Art. 6)
- AI literacy program for staff (Art. 4)
Data Encryption3 controls
- TLS 1.3 in transit
- AES-256 at rest (Neon)
- SHA-256 API key hashing
Access Control5 controls
- OAuth 2.0 (4 providers)
- JWT sessions
- API key auth with expiry
- Role-based plan gating
- CRON_SECRET for scheduled jobs
Monitoring & Logging4 controls
- Immutable audit logs (SOC 2 CC7)
- 25+ audited event types
- Health check endpoint (SOC 2 A1)
- Rate limit tracking
Application Security5 controls
- Content Security Policy (CSP)
- HSTS (2 years, preload)
- X-Frame-Options: SAMEORIGIN
- Rate limiting on all API routes
- Parameterized queries (SQL injection safe)
Privacy & Consent5 controls
- GDPR data export (Article 20)
- Right to deletion (cascade)
- Cookie consent (opt-in analytics)
- GA4 consent mode (denied by default)
- RFC 8058 email unsubscribe
Infrastructure4 controls
- Vercel edge network (global CDN)
- Neon serverless PostgreSQL (auto-failover)
- Stripe PCI DSS Level 1
- No secrets in codebase
Compliance Documents
Data Residency & Transfers
Primary application data is stored in Neon PostgreSQL (AWS us-east-1, United States). All data at rest is encrypted with AES-256.
Application hosting is provided by Vercel with a global CDN edge network. Static assets are cached at edge locations worldwide, but dynamic data processing occurs in the US-East region.
For EU data subjects, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission for any data transfers outside the EEA. All our sub-processors maintain equivalent data protection standards.
Incident Response
We maintain a structured incident response procedure aligned with SOC 2 CC7 and GDPR Article 33/34 requirements:
- Detection — Automated monitoring, audit log anomaly detection, and user reports.
- Classification — Severity assessment (P1-P4) based on data impact, scope, and regulatory implications.
- Containment — Immediate isolation of affected systems, credential rotation, access revocation.
- Notification — Affected data subjects and supervisory authorities notified within 72 hours as required by GDPR Article 33.
- Remediation & Post-mortem — Root cause analysis, corrective actions, process improvements documented and tracked.
Security Contact
For security inquiries, vulnerability reports, or compliance requests, contact us at loicjane@fleeceai.agency